{"vulnerability": "GHSA-3GJW-F78C-VVPW", "sightings": [{"uuid": "eeea9637-8821-472b-9f1c-4518a9950f57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3GJW-F78C-VVPW", "type": "seen", "source": "https://gist.github.com/alon710/0cbc434c452f0a0b70aa20e1c14d18f0", "content": "# GHSA-3GJW-F78C-VVPW: GHSA-3GJW-F78C-VVPW: Denial of Service via Unhandled Out-of-Bounds Indexing Panic in tokio-postgres\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-3GJW-F78C-VVPW\n\n## Summary\nAn issue was discovered in the tokio-postgres library for Rust prior to version 0.7.18. A trust assumption mismatch between the PostgreSQL protocol messages sent by a server and how they are parsed and indexed by the client-side library allows a rogue or compromised database server to trigger a Denial of Service (DoS) crash via an unhandled out-of-bounds slice indexing panic.\n\n## TL;DR\nUnvalidated DataRow field counts in tokio-postgres allow a rogue or compromised database server to crash client applications via an out-of-bounds panic.\n\n## Technical Details\n\n- **CWE ID**: CWE-129\n- **Attack Vector**: Network / Man-in-the-Middle / Malicious Database Connection\n- **CVSS Score**: 7.5 (Qualitative Assessment)\n- **EPSS Score**: N/A (No CVE Assigned)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- tokio-postgres library client applications\n- **tokio-postgres**: < 0.7.18 (Fixed in: `0.7.18`)\n\n## Mitigation\n\n- Upgrade tokio-postgres dependency to version 0.7.18 or higher.\n- Enable strict TLS hostname and certificate validation for all PostgreSQL database connections.\n- Implement strict ingress/egress validation to prevent unauthorized connections to arbitrary user-controlled database hosts.\n\n**Remediation Steps:**\n1. Identify vulnerable dependencies using `cargo tree -p tokio-postgres` or scanning tools.\n2. Update Cargo.toml to define `tokio-postgres = \"0.7.18\"`.\n3. Execute `cargo update -p tokio-postgres` to download and lock the secured version.\n4. Review and enable TLS settings (`sslmode=verify-full` or equivalent) across database connectors.\n\n## References\n\n- [GitHub Security Advisory GHSA-3GJW-F78C-VVPW](https://github.com/advisories/GHSA-3GJW-F78C-VVPW)\n- [Fix Commit](https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1)\n- [tokio-postgres v0.7.18 Release Notes](https://github.com/rust-postgres/rust-postgres/releases/tag/tokio-postgres-v0.7.18)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-3GJW-F78C-VVPW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-24T20:31:44.394127Z"}]}